Export limit exceeded: 417482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417482 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112344 | 2026-10-28 | 6.8 Medium | ||
| Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary. | ||||
| CVE-2026-17615 | 1 Redhat | 21 Apache Camel Quarkus, Apicurio Registry, Build Keycloak and 18 more | 2026-10-28 | 7.5 High |
| A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability. | ||||
| CVE-2026-98098 | 1 Linux | 1 Linux Kernel | 2026-10-28 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry (publication) into the TIPC name table. If the number of these publications exceeds TIPC_MAX_PUBL (65535), protocol service types (such as node state and link state) are no longer inserted into the name table. This causes two issues: 1. User-space applications subscribing to node or link up/down events stop receiving notifications. 2. A NULL pointer dereference can occur: BUG: kernel NULL pointer dereference, address: 00000000000000d0 ... CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full) ... RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221) ... Call Trace: <IRQ> tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189) tipc_udp_recv (net/tipc/udp_media.c:389) Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute) -----------------------------|----------------------------- | ... | list_for_each_entry(publ, pls, binding_node) { | ... | __skb_queue_tail(list, skb); | ... | } | ... | hdr = buf_msg(skb_peek_tail(list)); ... | tipc_nametbl_publish(); | If 'tipc_nametbl_publish()' (Thread 1) fails because the number of local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a result, NULL is passed to 'buf_msg()', leading to a NULL pointer dereference. Fix these issues by allowing protocol service types (node state, link state, and topology server) to be inserted into the name table unconditionally. This ensures that users subscribing to these types always receive notifications. In addition, the maximum number of local user publications is reduced to (TIPC_MAX_PUBL - 1). This ensures that the maximum bulk size calculated in tipc_link_set_queue_limits() remains valid. | ||||
| CVE-2026-118345 | 1 Google | 1 Chrome | 2026-10-28 | 8.8 High |
| Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-98097 | 1 Linux | 1 Linux Kernel | 2026-10-28 | 5.3 Medium |
| In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer. Replace the strcpy(data, l->if_name) with memcpy() so that the pad bytes are actually written (l->if_name[] is zero padded) rather than sending random bytes from the skb to the remote system. Replace two other strcpy() with strscpy(). | ||||
| CVE-2023-52356 | 4 Apple, Debian, Libtiff and 1 more | 15 Ipados, Iphone Os, Macos and 12 more | 2026-10-28 | 7.5 High |
| A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. | ||||
| CVE-2026-111381 | 1 Freerdp | 1 Freerdp | 2026-10-28 | 7.3 High |
| FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded. | ||||
| CVE-2026-113943 | 1 Apple | 1 Macos | 2026-10-28 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-87357 | 1 Oracle | 1 Order Capture | 2026-10-28 | 7.2 High |
| Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture. Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-117613 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-10-28 | N/A |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities. | ||||
| CVE-2026-117614 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-10-28 | N/A |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. | ||||
| CVE-2026-117615 | 2 Jenkins, Jenkins Project | 2 Jenkins, Jenkins | 2026-10-28 | N/A |
| Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system. | ||||
| CVE-2026-105612 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-10-28 | 3.5 Low |
| PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions | ||||
| CVE-2026-105613 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-10-28 | 4.7 Medium |
| PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-100105 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-10-28 | 7.7 High |
| A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization). | ||||
| CVE-2026-116794 | 1 Eugeny | 1 Russh | 2026-10-28 | 5.5 Medium |
| russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0. | ||||
| CVE-2026-118688 | 1 Bytecodealliance | 1 Wasmtime | 2026-10-28 | 7.9 High |
| wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them. | ||||
| CVE-2026-118686 | 1 Espocrm | 1 Espocrm | 2026-10-28 | 7.5 High |
| EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users. | ||||
| CVE-2026-118685 | 1 Tooljet | 1 Tooljet | 2026-10-28 | 6.5 Medium |
| ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session. | ||||
| CVE-2026-118684 | 1 Project-monai | 1 Monai | 2026-10-28 | 5.9 Medium |
| MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution. | ||||